PT-2015-4011 · Qemu+1 · Libvirt+1

Martin Kletzander · Published 2014-12-18 · Updated 2024-06-15 · CVE-2014-8131

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 1.2.11

Description The issue arises from the qemu implementation of virConnectGetAllDomainStats in libvirt, which fails to handle locks correctly when a domain is skipped due to ACL restrictions. This allows remote authenticated users to cause a denial of service, resulting in a deadlock or segmentation fault and crash, by making a request to access domains they do not have privileges to access.

Recommendations For versions prior to 1.2.11, update to version 1.2.11 or later to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-2472

CVE-2014-8131

OPENSUSE-SU-2024:10209-1

Affected Products

Alt Linux

Libvirt

References · 98

• https://bdu.fstec.ru/vul/2015-07129 · Security Note
• https://bdu.fstec.ru/vul/2015-09272 · Security Note
• https://bdu.fstec.ru/vul/2015-09264 · Security Note
• https://bdu.fstec.ru/vul/2015-09256 · Security Note
• https://bdu.fstec.ru/vul/2015-07119 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8135 · Security Note
• https://bdu.fstec.ru/vul/2015-09259 · Security Note
• https://bdu.fstec.ru/vul/2015-07137 · Security Note
• https://bdu.fstec.ru/vul/2015-09147 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8131 · Security Note
• https://bdu.fstec.ru/vul/2015-07125 · Security Note
• https://bdu.fstec.ru/vul/2015-07131 · Security Note
• https://bdu.fstec.ru/vul/2015-09267 · Security Note
• https://bdu.fstec.ru/vul/2015-06012 · Security Note
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00005.html · Vendor Advisory